Windows RDP lets you log in using revoked passwords. Microsoft is OK with that.
arstechnica.com
Researchers say the behavior amounts to a persistent backdoor.